Privacy

The short version

We run team signup software. To do that, we hold your name, email, and — if you or your team choose to provide them — your phone number and your paddling profile, including your weight.

We don't sell your data. We don't use it for advertising. Mobile opt-in data is not shared with third parties for marketing. Your phone number stays private until you choose to share it, and you control whether your coaches can see your weight.

The rest of this page is the detail.

1. Who we are

Dragon SignUp, LLC, a Pennsylvania limited liability company, operates DragonSignUp ("we," "us," "our"). We are located in Pittsburgh, Pennsylvania.

This policy explains what personal information we collect through dragonsignup.com and the DragonSignUp application (the "Service"), how we use it, who we share it with, and what choices you have.

Questions about anything here: hello@dragonsignup.com.

2. This Service is for adults

You must be at least 18 years old to use DragonSignUp.

The Service is not directed to children. We do not knowingly collect personal information from anyone under 18, and Team Admins agree in our Terms of Service not to enter data about anyone under 18.

If you believe someone under 18 has provided us personal information — or that a Team Admin has entered a minor's information — contact us at hello@dragonsignup.com and we will delete it promptly.

3. Two different roles we play

This matters for knowing who to ask about your data.

For your account information, we decide how it's used, so you deal with us directly. Contact hello@dragonsignup.com.

For Team Content — the roster, events, registrations, and athlete attributes inside a Team — the Team controls that data and we process it on the Team's behalf. If you want data corrected or removed from a Team you belong to, start with your Team Admin. We will help, and we'll act on our own where we're legally required to, but the Team is the one making decisions about its roster.

4. What we collect

4.1 Information you give us

• Account: Name, email address, password (stored only as a bcrypt hash) - Required
• Phone number: Your phone number (used for optional SMS waitlist and event notifications) - Optional
• Paddling profile: Discipline, side preference, role eligibility, stroke eligibility - Optional
• Weight: Your body weight, stored canonically in kilograms. Used by coaches and by our lineup tools to balance boats. - Optional
• Weight visibility: Your choice of who can see your weight — "Coaches can see it" or "Hidden — only the system uses it" - Set by you
• Contact sharing: Your choice of whether teammates can see your phone number in the team directory. Off by default. - Set by you
• Team and event data: Teams you belong to, your role, events, registrations, waitlist positions, availability, lineups, regatta entries - Created by use
• Communications: Messages you send us for support - Optional

4.2 Information a Team Admin may give us about you

Your Team Admin can create your roster entry and enter your details before you ever sign in — including your name, email address, and phone number.

This is how team management normally works, but you should know it happens. A phone number entered by an admin stays hidden from the team directory until you explicitly turn on sharing, and you can correct or delete an admin-entered number from your profile page at any time.

4.3 Information we collect automatically

• Usage and product analytics: Actions in the app, associated with a hashed user identifier, collected via PostHog
• Error and performance data: Diagnostic information when something breaks, collected via Sentry
• Log data: IP address, browser and device type, timestamps, and pages requested
• Cookies: See Section 9

4.4 What we do not collect

We do not collect or store payment card numbers. When you subscribe to a paid plan, Stripe handles the card. We receive only a subscription status and a customer reference.

We do not collect medical or health records, injury history, or diagnoses. Weight is collected for boat balance, not for any health purpose, and we are not a HIPAA covered entity.

We do not collect government identifiers — no Social Security numbers, driver's license numbers, or passport numbers.

We do not collect precise geolocation.

We do not knowingly collect anything about anyone under 18.

5. Why we use it

• Provide the Service: Authenticate you, show your teams and events, run registrations and waitlist promotion, build lineups
• Communicate: Registration confirmations, waitlist promotion notices (via email and optional SMS), event reminders, password resets and sign-in links, and service announcements
• Support: Answer your questions and fix your problems
• Improve: Understand which features are used, find and fix bugs, measure performance
• Secure: Detect and prevent fraud, abuse, and unauthorized access; investigate incidents
• Bill: Process subscriptions and collect applicable sales tax
• Comply: Meet legal obligations and enforce our Terms of Service

We do not sell personal information. We do not share it for cross-context behavioral advertising. Mobile opt-in data is not shared with third parties for marketing. We do not use it to train third-party AI models.

6. A specific note on weight data

We collect weight because dragon boat and rowing lineups depend on balancing load across the boat. We know it's a number people can feel sensitive about, so here is exactly how it works:

It is optional. You can leave it blank. Accepted values are between 20 kg and 250 kg (roughly 44–550 lb).

You choose who sees it. "Coaches can see it" means Team Admins and coaches on your team can view the number. "Hidden — only the system uses it" means the lineup tools use it to balance the boat, but your coach does not see the number.

It is not shown in the team directory and is not visible to ordinary teammates.

It is not shared with any third party for any purpose beyond the infrastructure providers in Section 8 who host our database.

You can delete it at any time by clearing the field on your profile page.

We do not use it for anything but lineup and roster functions.

7. Who can see your information

7.1 Your teammates

Your name and email address are visible to members of teams you belong to, in that team's contact directory.

Your phone number is not visible unless you turn on "Share my phone number with teammates." It is off by default.

Your weight is not visible to ordinary teammates in any setting.

Registration and roster status — whether you're confirmed or waitlisted for an event — is visible to your team, because that's the point of the product.

7.2 Your Team Admins and coaches

Team Admins and Organization Admins can view and edit their team's roster data, including contact details on file and athlete attributes, and can export their team's contact list for team-management purposes. Coaches can see your weight if your visibility setting allows it.

Our Terms of Service require Team Admins to use exported contact data only for legitimate team administration — not for marketing, and not to transfer to anyone else. We cannot technically prevent misuse of data after it is exported. If a Team Admin misuses your information, contact us at hello@dragonsignup.com.

7.3 Service providers

We use a small set of vendors to run the product. Each processes data on our behalf, under its own privacy commitments:

• Railway: Application hosting and managed PostgreSQL database (All Service data at rest)
• Vercel: Frontend hosting and delivery (Request metadata, logs)
• Stripe: Payment processing for paid plans (Billing contact and payment details — we never see full card numbers)
• Resend: Transactional email delivery (Recipient email address and message content)
• Twilio: Transactional SMS delivery for waitlist promotion notices and event updates (Recipient phone number and message content)
• PostHog: Product analytics (Usage events with a hashed user identifier)
• Sentry: Error and performance monitoring (Technical diagnostic context)
• Better Stack: Log storage, uptime monitoring, and our public status page (Application logs, which include your account identifier and request metadata)
• Zoho: Support desk and help center (Your name, email address, and anything you write to us in a support request)
• Google / Apple: Optional sign-in (Authentication data if you choose to sign in with them)

7.4 Other disclosures

We may disclose information:

• When required by law — in response to a subpoena, court order, or other valid legal process. Where lawful and practical, we will notify you first.
• To protect rights and safety — where we reasonably believe disclosure is necessary to prevent harm, fraud, or a violation of our Terms.
• In a business transfer — if we are involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. We will notify you, and any acquirer remains bound by this policy until it gives you notice of a change.
• With your direction — when you ask us to.

8. Security

We take reasonable measures to protect your information, including:

• Passwords are hashed with bcrypt and never stored in a form we can read.
• Encryption in transit (HTTPS/TLS) and at rest at the database layer.
• Access controls — role-based permissions in the application, and access to production systems limited to those who need it.
• Managed infrastructure — our hosting providers handle operating system and database patching.
• Error monitoring so we find problems quickly.

No system is perfectly secure. We cannot guarantee absolute security, and you provide information at your own risk.

Breach notification. If a breach affecting your personal information occurs, we will notify you as required by the Pennsylvania Breach of Personal Information Notification Act (73 P.S. § 2301 et seq.) and any other applicable law.

Report a vulnerability. If you believe you've found a security issue, email hello@dragonsignup.com. We appreciate responsible disclosure and will not pursue action against good-faith research that doesn't access other users' data or degrade the Service.

9. Cookies and analytics

We use cookies and similar technologies for:

• Essential functions — keeping you signed in and maintaining your session. These are required for the Service to work.
• Product analytics — understanding feature usage via PostHog.

We do not use advertising cookies, and we do not run third-party ad trackers.

You can block or delete cookies in your browser, but blocking essential cookies will prevent you from signing in.

Do Not Track. Browsers send inconsistent Do Not Track signals and there is no agreed standard, so we do not currently respond to them.

10. How long we keep it

• Account information: While your account is active
• Team Content: While the Team is active, or until deleted by the Team
• After account deletion: Name, email and phone cleared immediately; everything remaining removed within 30 days
• Backups: Deleted data may persist in encrypted backups for up to 30 days, then rotates out
• Aggregated and de-identified analytics: Retained indefinitely — it no longer identifies you
• Billing records: Retained as required by tax and accounting law, typically 7 years
• Security and audit logs: 90 days

11. Your choices and rights

Everyone can:

• Access and update your account information and paddling profile from your profile page.
• Control your phone sharing with the "Share my phone number with teammates" setting.
• Control your weight visibility with the "Weight visibility" setting, or delete the value entirely.
• Export your data — Team Admins can export team contact data through the Service; individuals can request a copy of their own data at hello@dragonsignup.com
• Delete your account from your profile page. Any event seats you hold are released to the waitlist straight away, and your name, email and phone number are cleared. Everything remaining is permanently deleted within 30 days. You can't sign in again afterwards, and we can't undo it. If you're the only admin of a team that still has members, hand admin to someone else first — your profile page names the teams.
• Opt out of non-essential email or SMS alerts. Transactional messages — registration confirmations, waitlist promotions, password resets — are part of the Service and cannot be turned off while your account is active.
• Ask us anything about your data at hello@dragonsignup.com.

We will not discriminate against you for exercising any of these rights.

State privacy rights. Pennsylvania does not currently have a comprehensive consumer privacy law. If you live in a state that does — such as California, Colorado, Connecticut, Virginia, or others — you may have additional rights to access, correct, delete, or port your personal information, and to appeal a denial. We extend the choices described above to all users regardless of where they live. To make a formal request, email hello@dragonsignup.com with the subject line "Privacy Request." We will verify your identity through your account email and respond within the time your state's law requires (generally 45 days).

12. Where your data lives

The Service is operated in the United States and intended for users in the United States. Your information is stored and processed in the U.S.

If you access the Service from outside the U.S., you understand that your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your country.

13. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date at the top and post the revised policy here.

For material changes — a new category of data, a new purpose, or a new class of recipient — we will give at least 30 days' notice by email to the address on your account, or by a prominent in-product notice, before they take effect.

We encourage you to review this page periodically.

14. Contact us

DragonSignUP, LLC

4614 Idaline St

Pittsburgh, Pennsylvania 15224

Questions and requests: hello@dragonsignup.com

We aim to respond to privacy inquiries within 10 business days.

This Privacy Policy was last updated on August 31, 2026.